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REMARKS 

The Examiner has rejected Claims 1-3, 6-10, 1 1-13, 16-20, 21-23, and 26-30 
under 35 U.S.C. 103(a) as being unpatentable over Nachenberg (U.S. Patent No. 
5,826,031) in view of Banga et al. (U.S. Patent No. 6,240,447). Applicant respectfully 
disagrees with such rejection. 

Specifically, the Examiner relies on the following excerpt from Nachenberg to 
make a prior art showing of applicant's claimed "calculating during said virus scanning 
operation a measurement value indicative of an amount of data processing performed 
during said virus scanning operation" (see all independent claims). 

"CD?E based methods employ additional heuristics to determine 
what the detection of various stoppers and boosters indicates 
about the code being emulated. For example, if a number of 
stoppers have beer, found prior to the detection of any boosters, 
the emulation control module will likely decide that the host 
file is uninfected. On the other hand, if one or more stoppers 
are detected following detection of a number of boosters, the 
emulation control module will lively decide that the polymorphic 
loop has been fully decrypted to reveal the static virus body. In 
this case, virus scanning will proceed." (col. 2, lines 15 - 25) 

Applicant asserts that this excerpt in no way discloses, teaches, or even suggests 
"calculating during said virus scanning operation a measurement value indicative of an 
amount of data processing performed during said virus scanning operation." Nachenberg 
merely suggests the use of boosters, "sequences of instructions [that] are frequently found 
in polymorphic decryption loops", and stoppers, "sequences of instructions [that] are 
rarely found in decryption loops" as a means for determining whether a file is infected. 

In particular, the number of boosters and the number of stoppers are calculated 
during a virus scan and are compared against a threshold. As an example, Nachenberg 
states, "[i]f a number of stoppers have been found prior to a number of boosters, the 
emulation control module will likely decide that the host file is uninfected. On the other 
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hand, if one or more stoppers are detected following detection of a number of 
boosters... virus scanning will proceed" (see Column 1, line 67 - Column 2, line 25). 

This differs from applicant's claimed "calculating an amount of data processing 
performed during said scanning operation" in that Nachenberg is separately calculating a 
number of identified and unidentified instruction sequences while applicant is calculating 
a total amount of data processed during the scan. Nachenberg 1 s instruction sequences 
may individually include a substantial amount of data, such that the number of instruction 
sequences calculated will not be the same as the amount of data processed. Therefore, 
Nachenberg's calculation of boosters and stoppers is in no way meets applicant's claimed 
data processed calculation. 

The Examiner also cites the above excerpt as a prior art showing of applicant's 
claimed "wherein the measurement value is based, at least in part, on at least one of a 
data size of the computer file and a complexity of tests of the virus scanning operation" 
(see all independent claims). Contrary to the Examiner's assertion, applicant emphasizes 
that nowhere in Nachenberg, and especially nowhere in the above excerpt, is there even a 
suggestion of utilizing a test complexity value in determining whether a virus scanning 
should be terminated. 

Applicant emphasizes that such a complexity value inherently represents the 
amount of data processing typically required to conduct a particular test, where such 
value may be used to conditionally trigger a break in virus scanning. The above excerpt 
relied on by the Examiner simply discloses the use of boosters and stoppers as described 
above, and in no way even suggests applicant's claimed use of the "complexity of tests." 

Furthermore, with respect to the dependent claims, the Examiner cites 
Nachenberg to make a prior art showing of applicant's claimed "virus scanning operation 
[that] applies a plurality of the tests to said computer file, each test having a complexity 
value indicative of an amount of data processing associated with that test, said 
measurement value being a sum of complexity values for tests applied during said virus 
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scanning operation and said step of determining terminating said virus scanning operation 
prior to completion if said sum of complexity values exceeds a termination complexity 
threshold value" (see Claim 10). Applicant emphasizes that what is being claimed is a 
sum of complexity values for tests applied during the virus scanning operation where the 
operation is terminated if that sum exceeds a threshold value- 
As explained above, nowhere in Nachenberg is there even a suggestion of 
determining a complexity value of a test, let alone summing up the complexity values of 
tests used to scan a file and comparing that sum to a threshold value for determining 
whether the scan should be terminated. The excerpts from Nachenberg cited by the 
Examiner simply disclose boosters and stoppers as a means for determining whether a 
virus scan should proceed (see Column 1 , line 63 - Column 2, line 50) and the use of 
virtual machines in emulating the polymorphic virus which creates slow operability 
(Column 6, lines 32-40). These excerpts do not even remotely suggest summing test 
complexity values to determine whether a virus scanning operation should be terminated, 
thus preventing overload of a virus scanner. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck t 9M F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.l991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all the claim limitations. 
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Reconsideration is respectfully requested. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5 100. For payment of 
the fees due in connection with the filing of this paper, the Commissioner is authorized to 
charge such fees to Deposit Account No. 50-1351 (Order No. NAI1P157_00.091.01). 




K^vin J. Zilka 
Registration No. 41,429 



P.O. Box 721120 



San Jose, CA 95172-1120 
Telephone: (408)505-510,0 
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